SUSE-SU-2015:0168-1: moderate: Security update for binutils

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for binutils
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:0168-1
Rating:             moderate
References:         #902676 #902677 #903655 #905735 #905736 
Cross-References:   CVE-2014-8484 CVE-2014-8485 CVE-2014-8501
                    CVE-2014-8502 CVE-2014-8503 CVE-2014-8504
                    CVE-2014-8737 CVE-2014-8738
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11 SP3
                    SUSE Linux Enterprise Server 11 SP3 for VMware
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

   An update that fixes 8 vulnerabilities is now available.

Description:


   binutils has been updated to fix eight security issues:

       * Lack of range checking leading to controlled write in
         _bfd_elf_setup_sections() (CVE-2014-8485).
       * Invalid read flaw in libbfd (CVE-2014-8484).
       * Write to uninitialized memory in the PE parser (CVE-2014-8501).
       * Crash in the PE parser (CVE-2014-8502).
       * Segfault in the ihex parser when it encounters a malformed ihex file
         (CVE-2014-8503).
       * Stack buffer overflow in srec_scan (CVE-2014-8504).
       * Out-of-bounds memory write while processing a crafted "ar" archive
         (CVE-2014-8738).
       * Directory traversal vulnerability allowing random file
         deletion/creation (CVE-2014-8737).

   Security Issues:

       * CVE-2014-8501
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8501>
       * CVE-2014-8502
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8502>
       * CVE-2014-8503
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8503>
       * CVE-2014-8504
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8504>
       * CVE-2014-8485
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8485>
       * CVE-2014-8738
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8738>
       * CVE-2014-8484
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8484>
       * CVE-2014-8737
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8737>


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11 SP3:

      zypper in -t patch sdksp3-binutils-201501-10214

   - SUSE Linux Enterprise Server 11 SP3 for VMware:

      zypper in -t patch slessp3-binutils-201501-10214

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-binutils-201501-10214

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-binutils-201501-10214

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):

      binutils-devel-2.23.1-0.23.15
      cross-ppc-binutils-2.23.1-0.23.2
      cross-spu-binutils-2.23.1-0.23.2

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64):

      binutils-devel-32bit-2.23.1-0.23.15

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 x86_64):

      binutils-gold-2.23.1-0.23.15

   - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

      binutils-2.23.1-0.23.15

   - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

      binutils-2.23.1-0.23.15

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

      binutils-2.23.1-0.23.15


References:

   http://support.novell.com/security/cve/CVE-2014-8484.html
   http://support.novell.com/security/cve/CVE-2014-8485.html
   http://support.novell.com/security/cve/CVE-2014-8501.html
   http://support.novell.com/security/cve/CVE-2014-8502.html
   http://support.novell.com/security/cve/CVE-2014-8503.html
   http://support.novell.com/security/cve/CVE-2014-8504.html
   http://support.novell.com/security/cve/CVE-2014-8737.html
   http://support.novell.com/security/cve/CVE-2014-8738.html
   https://bugzilla.suse.com/show_bug.cgi?id=902676
   https://bugzilla.suse.com/show_bug.cgi?id=902677
   https://bugzilla.suse.com/show_bug.cgi?id=903655
   https://bugzilla.suse.com/show_bug.cgi?id=905735
   https://bugzilla.suse.com/show_bug.cgi?id=905736
   http://download.suse.com/patch/finder/?keywords=6d27b48bf1cdae29eb4a858e0913fa3f